In a move designed to protect the insurer and allow for more cyber policies to be issued, this bond is new to cyberinsurance, but not to insurers as a whole.
Even insurers have their limits when it comes to paying out on policies. We’ve seen it here in Florida when hurricane claims wipe out the bank account of insurers. With the potential for a widespread attack like we saw years ago with WannaCry, cyberinsurers are realizing that – despite their efforts to minimize their risk through tightening up policy scope and insured requirements – they still need an ability to cover their risk.
U.K. cyberinsurer Beazley recently announced the availability of a cyber catastrophe bond. According to the Financial Times, Beazley believes “having access to a larger source of capital would also help the firm hedge and grow, and ultimately scale to providing billions of dollars worth of cover.”
This news is both promising and concerning. On the one hand, having an ability to offer more policies and, potentially, cover more losses for victim organizations is a good thing. But on the other, it also demonstrates the reality that – as I began this article with – insurers only have so much money, making this “safety net” one that may not sustain a victim organization should the “perfect storm” attack occur.
It's the very reason you see me advocating for as strong a security stance to prevent any kind of cyberattack as possible – particularly those that leverage phishing and/or social engineering as initial attack vectors, which can only be truly stopped by users that are vigilant enough because they continually take Security Awareness Training.